Uncovering the hidden risks inside smartphones

Inside every phone are components most users never think about, capable of silently sharing your location, sending messages, or opening a browser without you ever knowing. At the University of Birmingham, Dr Marius Muench has spent years cracking this black box open before the wrong people do.

A digital device can sit idle on a desk, screen locked and untouched, yet still be active in ways its owner cannot see and would not expect. Beneath the screen lies a set of separate processors, each running its own code and carrying its own vulnerabilities.

"I consider myself a researcher in low-level cybersecurity”, says Marius Muench, whose work as Assistant Professor of Cyber Security focuses on “everything which is typically not directly visible to the user, but affects them tremendously because it's deployed in all the devices out there."

His work is built on a simple idea: systems need to be tested under adversarial conditions, a principle he has spent years applying to parts of modern devices that the industry has largely left untested.

Untested, hidden, inside every phone

Most people interact with their phone through its operating system—the main software, such as Android or iOS, that runs apps and controls what appears on screen. What sits beneath it is considerably less familiar.

Every phone also contains a second, entirely separate processor with a single dedicated job: managing communication for the phone. "A lot of people are not aware that the software implementing communication with a cell tower—2G, 3G, 4G, 5G—runs on a completely separate chip," says Muench. "It's a dedicated processor, highly proprietary, produced by only five or six vendors in the world…and they keep the source code of their implementation secret."

This system, known as the baseband, operates largely outside the reach of the main operating system. Its code is not publicly available, cannot be independently audited, and offers little opportunity for inspection—whether by external researchers or by the users who rely on it.

Built up over decades, cellular standards have accumulated layers of complexity. “There’s a large amount of software, not a lot of introspectability—and as a result, a high-profile impact,” Muench concludes.

Because this layer communicates directly with the network, it can be reached over the air. An attacker within wireless range can simulate a cell tower and send crafted signals to test how the system responds. "If you can attack a cellular baseband processor, you get access to a victim's communications," warns Muench, with documented attack chains reaching into the Android runtime, demonstrating how this layer can serve as a foothold into the device.

Yet cellular vulnerabilities remain among the least reported in wireless security tracking, reflecting how difficult these systems are to access and study in practice.

Turbulence testing for smartphones

By default, testing for the baseband follows a narrow pattern: systems are evaluated against expected behaviour. Does the device respond correctly to valid inputs? Does it comply with the standards that define how cellular networks should operate?

This process uses well-formed, legitimate inputs—signals a real cell tower would actually send. While necessary, it only confirms one side of security: that the device complies with its specification. "If you have an aeroplane, you use wind tunnels and stress testing rigs to put it under adverse conditions before it flies," says Muench. "For baseband processors, that kind of adversarial testing doesn't exist in the design process, which is why we built it."

His approach recreates the baseband environment outside the device. Without access to source code or internal specifications, Muench extracts the compiled firmware and replicates it in a virtual environment, where it can be subjected to large volumes of adversarial inputs. The result was FirmWire, published at the Network and Distributed System Security Symposium (NDSS) 2022: the first platform to bring systematic adversarial testing to baseband firmware, now widely used across the field.

Moving the firmware into a controlled environment changes what can be tested. “We find attack scenarios and types of bugs which people simply didn’t think about, and had no way of testing for,” explains Muench, describing a shift that has helped surface more than 20 vulnerabilities across 2G and 4G baseband software stacks, with patches from Google, Samsung, and MediaTek.

The FirmWire approach has since expanded to network-connected phones through BaseBridge and to SIM security with SIMurai. For Muench, these projects share the same goal: making security testing more accessible to third parties.

Building on this earlier work, Muench and Tomasz Piotr Lisowski, working with Kristian Covic from IT security company Fuzzware, developed CATana, a toolkit for exploring the dangers of SIM-originating commands across different devices.

The spec that turns a SIM into a threat

That a component as familiar as the SIM card can act in ways its owner never intended, and never sees, is what makes it worth understanding. This danger begins with a misconception: "What people don't realise is that SIM cards are tiny computers," explains Muench. "They don't just store secrets to access the network; they can directly interact with the phone. And there is a full specification defining what a SIM is allowed to request from the phone."

A SIM can instruct the phone to reveal its location, send an SMS, or open the browser at a specified address; combine the first two, and a hostile SIM becomes a passive tracking device. Muench’s work shows that this is not a single vulnerability, but a class of risks that can be understood across three attack surfaces:

Physical attacks that require access to the device or SIM. In practice, this can be as simple as placing a thin hardware interposer between the SIM and the phone: a commercially available layer, often sold for carrier unlocking, that can be planted in seconds to manipulate the commands exchanged by the two. Using this approach combined with SIMurai’s adversarial testing, Muench’s team discovered a regression in Android 14, patched in December 2025, that allowed a SIM inserted into a locked phone to silently open the browser to an attacker-chosen address. "If I lose my phone or it gets stolen, I would be very happy if someone could not access my data. These kinds of things are, in my opinion, not great for a user,” reflects Muench.

Remote attacks, where the SIM is reached through the same infrastructure that allows it to be managed by the operator. “The software just updates, and the user would never know,” warns Muench. Leaked intelligence documents suggest state agencies have been using similar methods to decrypt calls and messages since at least 2010.

Technical attacks that exploit flaws in the SIM software itself. Like any software, SIM applications can mishandle unexpected inputs from the phone, turning trusted functionality into behaviour the designers never intended. SimJacker attacks, originally observed in 2019 and still in use today, are showing what this type of SIM exploitation can do at scale: a crafted SMS message exploited a vulnerability in legacy SIM software to silently retrieve the locations of thousands of devices across tens of countries, without any user interaction or visible signs.

What makes these attacks particularly concerning is that these capabilities are not necessarily the result of a vulnerability in the SIM itself. They are defined by the technical specifications governing how SIMs interact with mobile devices, meaning a device can behave exactly as specified while still exposing an unexpected security risk.

Building on this attacker model, Muench and Tomasz Piotr Lisowski worked together with Kristian Covic from IT security company Fuzzware to develop CATana, a toolkit for exploring the dangers of SIM-originating AT commands across different devices. In their latest research, they then used the toolkit to test 26 devices, including 18 smartphones and eight cellular-connected IoT modules used in electric vehicle chargers, industrial equipment and connected cars.

The research shows that SIM-originating AT commands could extract sensitive information, send messages or initiate calls, force devices onto less secure 2G networks, shut them down or disable cellular communications. In some cases, the researchers were able to obtain arbitrary command execution on the device’s communication processor.

The researchers also reported their findings to the GSMA and affected manufacturers, several of which responded with software updates or hardened configurations.

One hole after another

Fixing one vulnerability is not the same as fixing the underlying problem. In 2024, when Marius Muench’s team identified a faulty boundary check in the code handling a routine cellular function on Pixel devices, Google patched it and paid a bug bounty; months later, a different flaw appeared in the same function, also later patched: same class of error, different line. For Muench, this makes the case for more comprehensive and systemic security measures. "It's not enough to mitigate vulnerabilities one by one," he says. "We need robust systems in the first place."

There are signs that this is beginning to change. Muench highlights Google Pixel 10’s memory-safe firmware components and Raspberry Pi's RP2350 Hacking Challenge as examples of the industry beginning to treat security more seriously. "Vendors used to say: 'Oh, this is an arcane attack that only works if it's full moon on the first of the month,' he notes, “but there's been quite a shift in recent years: vendors are trying to get their systems secure, looking into proactive security measures, helping academics to do their research and, most importantly, listening to us."

This content was provided by the University of Birmingham. The editorial staff of The Chronicle had no role in its preparation. Find out more about paid content.